You bought a car that’s supposed to be smart. You installed an app to control it. And then, one day, the app stops working — not because your phone is broken, but because you chose to use a more secure operating system. Welcome to Volkswagen’s version of “security.”
Volkswagen has quietly blocked the myVW app from running on devices that use GrapheneOS — a privacy-hardened, security-focused version of Android. Their official reason? Security. But here’s where it gets ugly: they still fully support Android 10, a version that’s been abandoned by Google and is riddled with unpatched vulnerabilities. They don’t want you to have a secure phone. They want you to have a compliant phone.
Let’s call this what it is: corporate hypocrisy dressed up in a firewall. The same company that claims to care about your safety is actively blocking the one OS that actually protects your data. Meanwhile, they’re happy to let you connect with a decade-old Android that leaks your location, contacts, and driving habits like a sieve.
Why? Because GrapheneOS doesn’t play nice with the tracking and telemetry that Volkswagen — like every modern automaker — relies on. The myVW app isn’t just a remote start tool. It’s a data collection pipeline. GrapheneOS strips out Google Play Services, the very backbone of that pipeline. So when Volkswagen says “security concern,” what they really mean is “we can’t harvest your data.”
This isn’t an isolated incident. It’s a pattern. Smart TVs, home assistants, even your fridge — companies are increasingly using “security” as a cudgel to lock down your devices and lock you into their ecosystem. The message is clear: your device belongs to them, not to you. Real security is a threat to their business model, so they pretend it’s a threat to yours.
I’ve seen this firsthand. A friend installed GrapheneOS on his Pixel, locked down his permissions, and suddenly his car app refused to connect. He called support. They said “unsupported OS.” He asked why Android 10 was fine. Silence. Then a canned response about “security policies.” Policies that conveniently protect the company’s interests, not the user’s.
The irony is staggering. The same people who pump out “security updates” for their infotainment systems that never arrive are blocking a OS that receives monthly patches from a dedicated community. Volkswagen’s own software is a known vulnerability nightmare — researchers have shown you can hack a VW ID.4 through the cloud. But sure, blame GrapheneOS.
Here’s what you can do: vote with your wallet. The top comment on the original article says it best: “I’ll add these bastards to the list of car companies from which I will not buy.” That’s the only language they understand. If you own a Volkswagen, switch to an app that respects your privacy — or better yet, refuse to install the app at all. Use the key fob. It’s less convenient, but it’s not spying on you.
We need to stop accepting the premise that “security” means giving up control. It doesn’t. Security means you get to choose who has access to your data. Volkswagen has chosen to block the one OS that gives you that choice. Don’t let them gaslight you into thinking that protecting yourself is the problem.
FAQ
Q: But isn't blocking a non-standard OS a valid security measure for Volkswagen?
A: If it were about security, they'd block all outdated Android versions too. They don't. They specifically block GrapheneOS, which removes the tracking infrastructure. The inconsistency reveals the real motive: protecting their data pipeline, not your device.
Q: What does this mean for me as a Volkswagen owner?
A: It means your car app is a data collection tool disguised as a convenience. If you value privacy, avoid connecting your phone to the myVW app. Use the key fob or consider a carmaker that doesn't punish you for using a secure OS.
Q: Couldn't Volkswagen argue that GrapheneOS lacks certain security certifications or compatibility?
A: They could, but they haven't. And even if they did, they'd still have to explain why they allow Android 10, which lacks any modern security certification. The burden of proof is on them to show that their policy is consistent. It isn't.