The same company that leaked the parking spots of 800,000 cars last year now says privacy-focused GrapheneOS phones aren\u2019t trustworthy enough for its app.<\/h5>\n\n\n\n![\"Close-up](\"https:\/\/media.reclaimthenet.org\/2026\/07\/uD2cfEo6LK56.jpg\")
<\/figure>\n\n\n\nBy Rick Findlay<\/p>\n\n\n\n
GrapheneOS wants Volkswagen drivers to start making noise. The privacy-focused Android project has confirmed what owners began reporting in mid-June, that Volkswagen\u2019s companion app no longer works on GrapheneOS phones<\/a>, locking people out of remote door controls, charging settings, and even the ability to see where they parked.<\/p>\n\n\n\nAlongside that confirmation came a pointed comparison. Two of Volkswagen\u2019s rivals already solved the exact problem Volkswagen now blames on technical necessity.<\/p>\n\n\n\n
Hyundai and Kia both added official GrapheneOS support<\/a> to their apps several months before Volkswagen shut the door, the project said. They did it by verifying devices through hardware rather than leaning on Google\u2019s Play Integrity API, the attestation system sitting at the center of this dispute. The workable path exists, two competitors have already taken it, and Volkswagen went the other direction.<\/p>\n\n\n\nWriting on X, the GrapheneOS team said there was \u201cno legitimate reason<\/a>\u201d for Volkswagen to exclude the operating system, arguing the carmaker could check devices using hardware-backed verification instead of relying solely on Google\u2019s API. That single design choice explains the whole standoff.<\/p>\n\n\n\nHere is what attestation actually does. When the Volkswagen app launches, it asks Google a question through the Play Integrity API, roughly whether the phone is a legitimate, unmodified Android device.<\/p>\n\n\n\n
GrapheneOS fails that check, and not because it is insecure. It fails because Google\u2019s list of approved devices does not include it. GrapheneOS runs a locked bootloader and verified boot, sandboxes apps more tightly than stock Android, and strips out the Google components that harvest user data in the background. The attestation system reads all of that hardening as a red flag, treating a more private phone as a less trustworthy one.<\/p>\n\n\n\n
That outcome is the issue for any Volkswagen owner who chose GrapheneOS to get away from Google in the first place. Volkswagen is using Google\u2019s gatekeeping to herd those exact users back into Google\u2019s ecosystem, the one they deliberately left.<\/p>\n\n\n\n
When one affected user, XavDub<\/a>, contacted Volkswagen, the response was that GrapheneOS \u201cis not an official Volkswagen offering,\u201d with a suggestion to contact their OS provider instead.<\/p>\n\n\n\nXavDub described the failure. \u201cFirst symptom, sync did not work anymore from the app, so I tried to logout to login again, but it\u2019s since just impossible,\u201d they wrote, noting that the identical login worked fine on a stock Google Pixel.<\/p>\n\n\n\n
Volkswagen\u2019s app still functions on older, end-of-life Android builds carrying known holes, while rejecting an operating system that is arguably harder to compromise. A company genuinely worried about device integrity would not wave through outdated phones and block a hardened one. The behavior points at control, not protection.<\/p>\n\n\n\n
This lockout also lands in the middle of a broader squeeze on what drivers can do with their own vehicles. Volkswagen recently changed the APIs used to reach vehicle data, and according to German outlet Heise<\/a>, that change broke third-party tools owners relied on for smart charging, solar integration, and home automation.<\/p>\n\n\n\nThat leaves customers more dependent on Volkswagen\u2019s own software and further from the data their cars generate, which raises a fair question about how any of this squares with the EU Data Act\u2019s goal<\/a> of giving people access to connected-device information.<\/p>\n\n\n\n
<\/figure>\n\n\n\nBy Rick Findlay<\/p>\n\n\n\n
GrapheneOS wants Volkswagen drivers to start making noise. The privacy-focused Android project has confirmed what owners began reporting in mid-June, that Volkswagen\u2019s companion app no longer works on GrapheneOS phones<\/a>, locking people out of remote door controls, charging settings, and even the ability to see where they parked.<\/p>\n\n\n\n Alongside that confirmation came a pointed comparison. Two of Volkswagen\u2019s rivals already solved the exact problem Volkswagen now blames on technical necessity.<\/p>\n\n\n\n Hyundai and Kia both added official GrapheneOS support<\/a> to their apps several months before Volkswagen shut the door, the project said. They did it by verifying devices through hardware rather than leaning on Google\u2019s Play Integrity API, the attestation system sitting at the center of this dispute. The workable path exists, two competitors have already taken it, and Volkswagen went the other direction.<\/p>\n\n\n\n Writing on X, the GrapheneOS team said there was \u201cno legitimate reason<\/a>\u201d for Volkswagen to exclude the operating system, arguing the carmaker could check devices using hardware-backed verification instead of relying solely on Google\u2019s API. That single design choice explains the whole standoff.<\/p>\n\n\n\n Here is what attestation actually does. When the Volkswagen app launches, it asks Google a question through the Play Integrity API, roughly whether the phone is a legitimate, unmodified Android device.<\/p>\n\n\n\n GrapheneOS fails that check, and not because it is insecure. It fails because Google\u2019s list of approved devices does not include it. GrapheneOS runs a locked bootloader and verified boot, sandboxes apps more tightly than stock Android, and strips out the Google components that harvest user data in the background. The attestation system reads all of that hardening as a red flag, treating a more private phone as a less trustworthy one.<\/p>\n\n\n\n That outcome is the issue for any Volkswagen owner who chose GrapheneOS to get away from Google in the first place. Volkswagen is using Google\u2019s gatekeeping to herd those exact users back into Google\u2019s ecosystem, the one they deliberately left.<\/p>\n\n\n\n When one affected user, XavDub<\/a>, contacted Volkswagen, the response was that GrapheneOS \u201cis not an official Volkswagen offering,\u201d with a suggestion to contact their OS provider instead.<\/p>\n\n\n\n XavDub described the failure. \u201cFirst symptom, sync did not work anymore from the app, so I tried to logout to login again, but it\u2019s since just impossible,\u201d they wrote, noting that the identical login worked fine on a stock Google Pixel.<\/p>\n\n\n\n Volkswagen\u2019s app still functions on older, end-of-life Android builds carrying known holes, while rejecting an operating system that is arguably harder to compromise. A company genuinely worried about device integrity would not wave through outdated phones and block a hardened one. The behavior points at control, not protection.<\/p>\n\n\n\n This lockout also lands in the middle of a broader squeeze on what drivers can do with their own vehicles. Volkswagen recently changed the APIs used to reach vehicle data, and according to German outlet Heise<\/a>, that change broke third-party tools owners relied on for smart charging, solar integration, and home automation.<\/p>\n\n\n\n That leaves customers more dependent on Volkswagen\u2019s own software and further from the data their cars generate, which raises a fair question about how any of this squares with the EU Data Act\u2019s goal<\/a> of giving people access to connected-device information.<\/p>\n\n\n\n