That the shooter was only 20, and presumably had a pair of handguns is going to be an interesting twist once the press gets on that angle. Or maybe they won't because the laws in both states the shooter seems to be tied to didn't work or were ignored.
That the shooter at the suburban Milwaukee spa who was out to get his estranged wife bought it in a private sale through Armslist.com while under arms prohibition due to a restraining/protection order is the subject of a lawsuit currently.
AFAIK, NJ does allow private sales between individuals, but they must both have a FID/FOID card. And you can't get one for a pistol if under 21.
In CT, you can do a non-FFL private sale, but it has to be run through the State with forms/checks and both must have ownership permits. Again, under 21 not permitted.
(Ah, now some reports say he was 24 and a relative of a teacher at the school.)