As mentioned, in California (and, I believe, some other States) pretty much all transfers must go through an FFL. I'm sure that there are illegal, fully private transfers, but I'm not sure that anyone knows how many.
I suspect that the level of voluntary compliance is quite high. It's not all that inconvenient, and most folks want to avoid the potential complications of participating in an illegal, felonious act. It will take two people willing to accept the risk to do an illegal transfer.
How to catch people is law enforcement's problem. But I bet a few get caught by bragging about it on the Internet or to their buddies at the LGS or range (perhaps withing earshot of an LEO).
Formerly known as fiddletown