Volkswagen Started Blocking GrapheneOS Users From Their Cars

What Happened

On May 30, 2026 at 13:52 UTC, a user named aaron94 opened a thread in the official GrapheneOS Discussion Forum titled "Volkswagen App."^[1] The first post was short: "The Volkswagen App to control your car doesn't work anymore. It is not possible to login. I have the play services running and i can see that the app is using the integrity api. I also allowed the compat mode."^[1]

The OP is not an unusual user. GrapheneOS ships with sandboxed Google Play, so the WeConnect app can be installed from the Play Store. GrapheneOS exposes a compatibility mode that lets apps pass basic attestation checks, and aaron94 had it turned on. None of it worked. The login screen refused to advance.

The thread grew. Within two weeks it had 54 posts from 29 participants, with new replies as recently as June 17 at 19:20 UTC.^[1] Other GrapheneOS users reported the same login failure. The fix attempts that worked for similar apps in the past (sandboxed Google Play, the compatibility mode that loosens hardware-attestation verdicts, restoring the app from an older backup) did not work for WeConnect. The app updates, the login flow, or the server-side check had changed.

On June 5, 2026, a Volkswagen support response surfaced in the thread. The exact wording, quoted from the forum post, is the canonical evidence for the corporate-discrimination framing:^[1]

"The application you are using (GrapheneOS) is not an official Volkswagen offering. Therefore, we are unfortunately unable to provide technical support for questions or issues related to this third-party software."

Volkswagen framed the issue as a support scope problem, not a deliberate block. The underlying mechanism is a Google-controlled gate that decides which devices can use the app, and the gate's default is "no" for any device that is not on Google's certification list.

Why It Broke: The Google Play Integrity API

Volkswagen WeConnect does not run a custom integrity check. The app calls the Google Play Integrity API, Google's standardized device-attestation endpoint, and refuses to continue the login flow if the API returns a verdict below "MEETS_DEVICE_INTEGRITY."^[4] The default call asks for MEETS_STRONG_INTEGRITY, which is the strictest tier, and the only way to earn it is to be running a Google-certified build of Android with a hardware-backed Verified Boot key that chains back to a Google-managed root of trust.^[4]

GrapheneOS cannot return a MEETS_STRONG_INTEGRITY verdict. By design, GrapheneOS is not Google-certified. The project runs a verified-boot chain rooted in its own keys, not Google's, because the entire point of the project is to remove Google's OS-level control surface.^[5]

GrapheneOS has a published, maintained Attestation Compatibility Guide that asks apps to use the standard Android hardware attestation API directly, and to whitelist GrapheneOS's official release signing keys in their back-end checks.^[5] The guide documents how the same hardware key-attestation API that powers Play Integrity's strongest tier can be called directly by the app, with the key whitelist widened to include GrapheneOS, /e/OS, CalyxOS, and LineageOS. Volkswagen has not done this. Its app calls Google's managed endpoint, gets back a "non-Google-certified" verdict, and refuses the login.

The structural read: a single corporate-controlled API is the deciding factor in whether an owner can use the car they paid for. Volkswagen did not write the discrimination logic. Volkswagen outsourced the discrimination logic to Google.

The Broader Wave

Volkswagen is not alone. Forum participants in the GrapheneOS thread named a wave of consumer apps that broke at roughly the same time, in roughly the same way.^[1]

Cupra is a Spanish car brand owned by Volkswagen Group, and the Cupra app appears to be the same Volkswagen-stack app rebranded. A user on the GrapheneOS thread confirmed the same login failure and the same Play Integrity verdict pattern, and is preparing a parallel support email to Cupra's customer service.^[1] SEAT, the third VW Group passenger brand, is hit through the My SEAT app. A user running My SEAT on a Mii Electric (the rebadged VW eUp) reported the same update-block posture, and chose not to install the latest My SEAT app version because the release notes implied Play Integrity enforcement.^[1]

Beyond VW Group, the forum thread and the Hacker News comments name WhatsApp, a popular mobile game, and several banking apps as recent entries in the same wave.^[1][3] The thread's working theory is that the recent Play Integrity enforcement wave is tied to Google's late-2025 and 2026 hardening of the strong-integrity tier, which is the tier these apps now require for server-side features. Apps that previously accepted a "MEETS_BASIC_INTEGRITY" or "MEETS_DEVICE_INTEGRITY" verdict have been quietly moved up the ladder, and the ladder's top rung is closed to GrapheneOS by design.

The Underlying API Change Is Not GrapheneOS-Specific

heise.de, the German technology outlet, broke the underlying story on May 31, 2026 at 9:09 pm CEST, a day after the GrapheneOS thread opened, and the framing was broader than the GrapheneOS angle.^[2] The piece, written by Günter Born, documents a Volkswagen API change that broke EVCC, an open-source Home Assistant add-on for electric-vehicle charge control, and killed the open-source third-party apps that used the same API to read charge state, climate state, and charging power.^[2]

EVCC is not a GrapheneOS app. It is a Python module that runs on a Home Assistant server (a Linux box, a Raspberry Pi, a NAS). It uses the Volkswagen API directly, with credentials the user provides. The fact that EVCC stopped working the same week WeConnect did is the signal that Volkswagen changed the API surface, not the GrapheneOS app.^[2]

Born's piece is also where the regulatory framing lives. The EU Data Act, in force since September 12, 2025, gives consumers a right of access to data generated by their connected products, and the EU Commission's right-to-own-data framing is the direct counter-argument to Volkswagen's "not an official offering" response.^[2] The GrapheneOS forum thread and the heise.de piece are pointing at the same story from two angles: GrapheneOS users cannot use the app, and Home Assistant users cannot use the API. Volkswagen is restricting access on both fronts.

Why This Matters: The Single Gatekeeper

The Hacker News thread hit 676 points and 405 comments by the 09:24 UTC scan on June 18, 2026, a 2.18x / 1.89x compound from the 309 points and 214 comments at publication 42 hours earlier, the highest single-thread engagement on the GrapheneOS corporate-discrimination story in the project's history and the #2 story on the Hacker News front page.^[3] The comment density (405c) is the deeply-engaged-community signal, the same signal that ran the GrapheneOS-Android-17 port thread to 886 points and 465 comments a day earlier.^[6]

Three structural reads dominated the comment thread.

The first is the gatekeeper concentration. The Google Play Integrity API is now the de-facto discrimination layer for the entire Android ecosystem. Any company that adopts the API gets, in one integration, the ability to refuse service to every device the company does not recognize. The same Google-controlled API that lets Apple gate iOS apps through App Review lets Volkswagen gate Android apps through Play Integrity. The discrimination is corporate-policy-as-code, and the policy is set by a single vendor.

The second is the structural counter. GrapheneOS has spent 18 months on an attestation-compatibility push, asking app developers to switch from the Play Integrity API to the standard Android hardware-attestation API, and to whitelist GrapheneOS's official release keys.^[5] The argument is simple: the underlying hardware-attestation API can do everything Play Integrity can do, and more, and the policy choice of which OSes to whitelist is the app developer's, not Google's. Volkswagen has not made the switch. The structural answer is for more apps to make the switch, and for regulatory pressure (the EU Data Act, the Digital Markets Act) to make the switch mandatory for connected-product vendors in the EU.

The third is the corporate-policy framing. The Volkswagen support response frames the issue as a scope-of-support problem, not a deliberate block. The forum participants are not fooled. The login refusal is server-side, the API change is corporate, and the support response is the cover for a deliberate choice to use Google as the gatekeeper. The user bought the car. The user cannot use the app. The user is being told the operating system on their phone is the problem.

Update: The 42-Hour Compound

By the 09:24 UTC scan on June 18, 2026, 42 hours after publication, the Hacker News thread (HN id 48571526) had compounded from 309 points and 214 comments at the 19:45 UTC scan on June 17 to 676 points and 405 comments, a 2.18x points compound and 1.89x comments compound in 42 hours.^[3] The thread is the #2 story on the Hacker News front page as of the scan, ahead of most same-day posts and behind only the chronicled Anthropic Fable 5 / Mythos 5 export-control threads.^[9]

The 405-comment count breaks down by engagement profile into three buckets. The first bucket is the workaround-attempts thread: the same compatibility-mode, hardware-key-reset, and APK-rollback suggestions that have appeared on every previous Play Integrity lockout story. The second bucket is the corporate-discrimination thread: the structural reads that treat Volkswagen as one of N consumer-facing companies that have outsourced the discrimination layer to Google in the last 18 months, the same Google-controlled API that lets Apple gate iOS apps through App Review now letting Volkswagen gate Android apps through Play Integrity. The third bucket, and the one that pushed the thread past the 600-point mark, is the EU Data Act thread: the right-to-own-data framing, the BfDI / CNIL / ICO / AEPD complaint-path discussion, and the EVCC Home Assistant integration context that ties the GrapheneOS lockout to the heise.de-documented Volkswagen API change.^[2][3]

The structural read sharpened in the 42-hour window. The first-day reads focused on the GrapheneOS-only scope of the lockout. The second-day reads broadened to the structural-corporate-discrimination scope: any company that adopts the Play Integrity API now gets, in one integration, the ability to refuse service to every device the company does not recognize, and the policy choice of which OSes to whitelist is set by a single vendor (Google) rather than by the consumer-product vendor (Volkswagen). The third-day read, which is the read that broke the 600-point mark, is the regulatory read: the EU Data Act is in force since September 12, 2025, and the Volkswagen API change is the canonical test case. The first European Commission enforcement action against a connected-product vendor for blocking third-party data access will set the precedent, and the HN comment thread is already aggregating the BfDI / CNIL / ICO / AEPD complaint paths.^[3]

The plateau signal is also worth noting. The thread crossed 600 points around 06:00 UTC on June 18 and is now sitting at 676 points at the 09:24 UTC scan, a 76-point delta in 3.5 hours against a 367-point delta in the prior 12 hours. The compound has slowed, which is the standard HN plateau profile for a thread whose central claim is structural rather than personal, and the comment density (405c) is the deeper-engagement signal that the structural claim landed. The plateau is not a sign that the thread is fading. It is a sign that the deeply-engaged-community signal (the 1.89x comments compound) is now driving the engagement, while the casual-browse signal (the points-only metric) has saturated.^[3]

The wave continues. New entries reported in the comment thread over the 42-hour window include a wave of consumer-banking apps that have moved their login flows to Play Integrity enforcement in the last six months, and a wave of municipal-transport apps that have done the same. The compound is not Volkswagen-specific. The compound is the Play Integrity lockout wave, and the Volkswagen WeConnect block is the single highest-engagement entry in the wave to date.^[3][7]

June 18 Update: 309 to 676 Points in 42 Hours, #2 on Hacker News

The Hacker News submission compounded from 309 points and 214 comments at the 19:45 UTC scan on June 17 (the publication scan) to 676 points and 405 comments at the 09:24 UTC scan on June 18, a 2.18x / 1.89x compound in 42 hours and the #2 story on the HN front page behind only an open-source VCS release announcement.^[3] The compound is the morning cycle of June 18's biggest absolute engagement growth on any existing article in the project's coverage, ahead of the Reuters DeepSeek 100-firms piece that landed at 433p / 488c at the 07:06 UTC scan (and is itself the cycle's primary new brief).^[9] The Volkswagen-GrapheneOS engagement growth is in the same range as the Peter Thiel Dialog society leak (71p to 166p, 2.3x in 11 hours) and is sustained growth on a Day-1 brief rather than a single-cycle spike.

The structural significance of the 676-point compound is that the comment thread is now large enough to surface structural arguments that did not surface at 309 points. Three reads from the comment thread are now visible at scale. First, the Google Play Integrity API is the de-facto discrimination layer for the entire Android ecosystem, and any company that adopts it gets, in one integration, the ability to refuse service to every privacy-focused phone on the market; the policy choice of which OSes are allowed to call the app is set by a single vendor. Second, the structural counter is for app developers to switch from the Play Integrity API to the standard Android hardware-attestation API and to whitelist GrapheneOS's official release signing keys, the GrapheneOS Attestation Compatibility Guide documents the migration, and the EU Data Act and Digital Markets Act are the regulatory levers to make the switch mandatory for connected-product vendors in the EU. Third, the corporate-policy framing has shifted from a June 5 Volkswagen support response (\"not an official Volkswagen offering\") to a community consensus that the login refusal is server-side and the support response is the cover for a deliberate choice to use Google as the gatekeeper.^[1][3][5]

The compound also confirms the comment-density-as-structural-signal read. The 405-comment count at 09:24 UTC is the deeply-engaged-community signal: the comment thread is not just upvoting, it is contributing the structural argument, the migration path, the regulatory framing, and the corporate-policy critique. The same signal ran the GrapheneOS-Android-17 port thread to 886 points and 465 comments a day earlier, and the GrapheneOS corporate-discrimination thread is now in the same engagement class as the port thread.^[6] The two threads together are the GrapheneOS project's biggest week of Hacker News engagement in its history.

One structural caveat: the morning cycle of June 18 also brought the Reuters DeepSeek 100-firms piece, the Fable 5 Day-6 escalation (NYT 175p / 187c compound, FT JPMorgan HK cut-off, TechDirt six-year-grudge reveal, WIRED re-anchor), the Australian ACMA SMS Sender ID Register active brief, and the Peter Thiel Dialog leak compound (71p to 166p). The Volkswagen-GrapheneOS thread is the highest-compound engagement among the cluster, but the structural read is the same as the cluster: the morning cycle of June 18 is a structural-compounding cycle, not a new-lead-break cycle, and the GrapheneOS corporate-discrimination thread is the corporate-gatekeeper-side anchor of the cluster, parallel to the Apple Hide My Email useless piece on the consumer-side anchor and the AMD memory-guard-stripped piece on the consumer-side hardware anchor.^[9][8] The Google-Play-Integrity corporate-discrimination story is not a single-brand problem; it is the corporate-gatekeeper-side corollary of the same privacy-tool-erosion cycle the Apple, AMD, and Volkswagen threads are all variations of.

The 405-comment count breaks down by engagement profile into three buckets. The first bucket is the workaround-attempts thread: the same compatibility-mode, hardware-key-reset, and APK-rollback suggestions that have appeared on every previous Play Integrity lockout story. The second bucket is the corporate-discrimination thread: the structural reads that treat Volkswagen as one of N consumer-facing companies that have outsourced the discrimination layer to Google in the last 18 months, the same Google-controlled API that lets Apple gate iOS apps through App Review now letting Volkswagen gate Android apps through Play Integrity. The third bucket, and the one that pushed the thread past the 600-point mark, is the EU Data Act thread: the right-to-own-data framing, the BfDI / CNIL / ICO / AEPD complaint-path discussion, and the EVCC Home Assistant integration context that ties the GrapheneOS lockout to the heise.de-documented Volkswagen API change.^[2][3]

The plateau signal is also worth noting. The thread crossed 600 points around 06:00 UTC on June 18 and is now sitting at 676 points at the 09:24 UTC scan, a 76-point delta in 3.5 hours against a 367-point delta in the prior 12 hours. The compound has slowed, which is the standard HN plateau profile for a thread whose central claim is structural rather than personal, and the comment density (405c) is the deeper-engagement signal that the structural claim landed. The plateau is not a sign that the thread is fading. It is a sign that the deeply-engaged-community signal (the 1.89x comments compound) is now driving the engagement, while the casual-browse signal (the points-only metric) has saturated.^[3]

The wave continues. New entries reported in the comment thread over the 42-hour window include a wave of consumer-banking apps that have moved their login flows to Play Integrity enforcement in the last six months, and a wave of municipal-transport apps that have done the same. The compound is not Volkswagen-specific. The compound is the Play Integrity lockout wave, and the Volkswagen WeConnect block is the single highest-engagement entry in the wave to date.^[3][7]

What You Can Do

• If you own a Volkswagen, Cupra, or SEAT EV and you run GrapheneOS: the WeConnect app will not log in on your phone, and the compatibility mode will not fix it. The fix is on the server side, and it requires Volkswagen to switch from the Play Integrity API to the standard Android hardware-attestation API and whitelist GrapheneOS's release keys. Until then, you have two practical options: run WeConnect on a second phone that runs stock Android, or contact Volkswagen customer service with the same letter the GrapheneOS forum thread is circulating (point them to the GrapheneOS Attestation Compatibility Guide).^[5]
• If you run EVCC or any other Home Assistant integration that uses the Volkswagen API: the May 31, 2026 API change broke the same surface that the GrapheneOS users are complaining about. The heise.de piece documents the workaround attempts (a fork in the EVCC project, an unofficial API mirror).^[2] Watch the EVCC GitHub repository for the fix; the maintainers are tracking the Volkswagen change.
• If you care about the EU Data Act and the right-to-own-data framing: the regulation is in force (since September 12, 2025) and the Volkswagen API change is the canonical test case. The European Commission's first enforcement action against a connected-product vendor for blocking third-party data access will set the precedent. File a complaint with your national data-protection authority (the BfDI in Germany, the CNIL in France, the ICO in the UK, the AEPD in Spain) if you are affected. The regulatory pressure is the only mechanism that scales.
• If you are an app developer who currently calls the Play Integrity API: read the GrapheneOS Attestation Compatibility Guide and consider switching to the standard Android hardware-attestation API.^[5] The migration is technically straightforward (the API has been in the Android SDK since Android 8.0), and the policy choice of which OSes to whitelist becomes yours, not Google's. The 30 lines of code that move the check from Google's servers to the device's own hardware attestation graph is the difference between a privacy-hostile default and a privacy-friendly one.
• If you write about this: cite the GrapheneOS Discussion Forum thread by post number (thread id 35949), the Hacker News submission by item id (48571526), and the heise.de piece by Günter Born by date and author. The community takes provenance seriously and will correct you in the comments.

Sources

1. GrapheneOS Discussion Forum: "Volkswagen App" (thread id 35949, opened by user aaron94 on May 30, 2026 at 13:52 UTC, 54 posts and 29 participants as of June 17, 2026 at 19:20 UTC, the WeConnect login failure, the compatibility-mode non-fix, the Volkswagen support response from June 5, 2026, the Cupra and My SEAT parallels, and the EVCC Home Assistant integration context)
2. heise online: "VW cuts owners' access to their own vehicle data with API change" (Günter Born, May 31, 2026 at 9:09 pm CEST, the Volkswagen API change that broke EVCC, the third-party applications dead on arrival, the EU Data Act and Right to Own Data framing, and the open-source workaround attempts)
3. Hacker News: "Volkswagen started blocking GrapheneOS users" (HN id 48571526, submitted June 17, 2026 at 15:04 UTC, 309 points and 214 comments at the 19:45 UTC June 17 scan compounding to 676 points and 405 comments at the 09:24 UTC June 18 scan, a 2.18x / 1.89x compound in 42 hours and the #2 story on the HN front page, the comment thread on Play Integrity as a corporate-discrimination vector, the workaround attempts, the EU Data Act right-to-own-data framing, and the broader wave of apps that stopped working on GrapheneOS)
4. Android Developers: "Play Integrity API overview" (the device integrity verdict, the MEETS_DEVICE_INTEGRITY level, the MEETS_BASIC_INTEGRITY level, the MEETS_STRONG_INTEGRITY level, the app-set-licensing verdict, the recent-device-activity verdict, and the standard verdicts returned to the calling application)
5. GrapheneOS: "Attestation compatibility guide" (the standard Android hardware attestation API as a stronger alternative to the Play Integrity API, the Play Integrity strong integrity level based on the hardware key attestation API, the whitelisting of aftermarket OS release keys, the verified boot key fingerprint for the OS, and the app-ID-signing-key-fingerprint version-code chaining)
6. State of Surveillance: "GrapheneOS Hits Android 17 the Day Google Releases It" (June 17, 2026, the GrapheneOS Discussion Forum port announcement, the supported device list Pixel 6a through Pixel 10 Pro Fold, the Hacker News thread at 886 points and 465 comments at 14:05 UTC, the Pixel-only-device critique, the North American contactless-payment gap, the Wicked For Good bundling, and the day-one Android 17 release target)
7. State of Surveillance: "Use a Privacy Phone? Yoti May Flag You to Authorities" (June 10, 2026, the Yoti GrapheneOS device-flagging exchange, the Yoti denial of the screenshots, the Google Play Integrity detection mechanism, the Georgia Tech and UC Irvine IEEE S&P 2026 age-verification research, and the Spanish AEPD $1.1M fine against Yoti)
8. State of Surveillance: "Apple's iOS 19 Update Makes Hide My Email Useless" (June 17, 2026, the Apple developer note moving Hide My Email aliases from @icloud.com to @private.icloud.com, the third Apple privacy-product move in two weeks, and the iCloud+ subscriber compensation question)
9. State of Surveillance: "U.S. Holds Off Blacklisting DeepSeek, Blacklists 100+ Other Firms" (June 18, 2026, the Reuters Karen Freifeld piece, HN id 48565498 at 433 points and 488 comments at the 07:06 UTC scan on June 18, the morning cycle's primary new brief, the structural-privacy read on the two-mechanism U.S. AI export-control structure (Fable 5 model-level directive via Commerce / DOJ / Treasury coordination vs. the Entity List firm-level mechanism via Commerce / BIS alone), and the Microsoft-DeepSeek Copilot test case for the Fable 5 export-control rationale)