Actually, they use both. They also use miniature explosions to create the effect of bullets hitting things.
In some cases they may shoot the scene with live rounds without any actors on scene and then do the exact same thing with the actors present but without live rounds. That way they get the realistic effects of bullet impacts, without putting the actors in danger.
