Volkswagen blocks GrapheneOS users: the app no longer lets them log in

A long thread on the GrapheneOS discussion forum documents a wave of failures in Volkswagen's Android app: owners say they can no longer log in, and the app is unusable on the security-focused Android distribution.

What stopped working

The thread was opened by a user who reported that the Volkswagen app used to control the car "doesn't work anymore" and that logging in is impossible. Google Play services were installed and running, and the app appears to use the Play Integrity API. Enabling the exploit-protection compatibility mode changed nothing.

Other owners confirmed the same pattern: synchronisation stopped first, and signing out to sign back in made login permanently impossible. Several noted that the affected devices are not rooted and run with a locked bootloader and Verified Boot — a configuration GrapheneOS argues is not an insecure or modified setup.

The failures are not limited to the Volkswagen brand. Owners of SEAT and Cupra cars, both part of the Volkswagen Group, report that their apps, which share the same back-end infrastructure, behave the same way. One SEAT owner pointed to the release notes for version 2.18 of the My SEAT app, which mention an integrity check.

What Volkswagen told users

Users who contacted support received a reply that forum members found unhelpful. In the response shared in the thread, Volkswagen said GrapheneOS "is not an official Volkswagen offering" and that it cannot provide technical support for it. The company added that the technical connection previously used by some third parties was not designed as official third-party access and is being gradually transferred to documented, standardised interfaces, and said use of its online mobile services is not affected. It advised the customer to contact Google technical support.

Forum members pointed out that the complaint concerns Volkswagen's own official app, not an unofficial integration such as a Home Assistant plugin. A link posted in the thread to a heise.de report titled "VW cuts owners' access to their own vehicle data with API change" suggests the change is part of a wider shift in how the company exposes vehicle data.

Why it matters

The case is the latest dispute over Android hardware attestation. GrapheneOS has published a compatibility guide arguing that apps can use Android hardware attestation and accept the project's verified boot keys instead of relying only on Play Integrity. Forum members are asking owners to email Volkswagen support and leave Play Store reviews, arguing that GrapheneOS's user base — estimated in the thread at around half a million — is large enough to be noticed.

Results have been mixed: some owners restored functionality by reinstalling the app from the Play Store and enabling Play services only for the first launch, while others saw the same errors on an iPhone. The thread remains open, and so does the question of whether Volkswagen will change its policy.