Polymer80 did not rat out their customer base. The ATF subpoenaed records from Stamps.com (which sells stamps/postage labels) and Authorize.net (which serves as man-in-the-middle authorization for credit card purchases) to get the details of everyone who had bought a "Buy, Build, Shoot" kit over about an 18 month period. This article states they also ran the customer list against the NICS to test for prohibited persons but fails to follow up as to whether the ATF only went after end-users who were prohibited, or even if they made a special point of targeting them.