Volkswagen Just Locked Out Home Assistant. Whose Car Is It, Really?

You bought the car. You did not, it turns out, buy the data coming out of it. Volkswagen recently pushed an authentication change that technically severed Home Assistant’s unofficial integration with its vehicles, and the open-source community is furious. On the surface this looks like a routine API tweak. Underneath it is a much bigger question: what does ownership mean in the connected-car era?

What actually broke

Home Assistant is a self-hosted smart home platform with hundreds of thousands of users worldwide — the kind of project that lives on a Raspberry Pi in someone’s utility closet and quietly runs their entire house. For years, VW owners used a community-built integration to pull battery level, odometer, lock status, and charge state into their own dashboards.

Then VW added client assertion verification between its mobile app and its backend API. In plain terms: the server now demands cryptographic proof that requests are coming from the official app. Every unofficial client — Home Assistant included — got locked out overnight.

“Blocked” is doing a lot of work here

Technically, VW did nothing wrong. A company is entirely within its rights to restrict its own API to its own app. But framing it as a security upgrade glosses over what it actually means for the person who owns the car.

Once the integration breaks, the owner loses the ability to do anything with their vehicle’s data that VW hasn’t explicitly sanctioned. Want to trigger your garage door when the car pulls into the driveway? Stop charging when the battery hits 80%? Pipe trip data into your own spreadsheet? All of that now has to happen inside VW’s app, within VW’s permitted use cases. The data is generated by your car. The right to act on it sits with the manufacturer.

The real reason automakers are locking APIs

The stated reason is always security. A sloppy third-party client mishandling auth tokens could theoretically expose vehicle unlock commands. Fair enough — there’s a real argument there.

But the cynical read is harder to dismiss. First, data monetization. Driving patterns, location traces, and vehicle telemetry are extremely valuable to insurers, advertisers, and mapping companies. Every owner who pipes that data into their own system is data the manufacturer can’t sell.

Second, subscription protection. Remember BMW’s attempt to charge a monthly fee for heated seats? Automakers are aggressively moving toward a model where hardware ships with capabilities locked in software, unlocked by subscription. That model collapses the moment owners can freely access and control their own vehicle data.

“My car” doesn’t mean what it used to

What’s striking about the Home Assistant community reaction on GitHub and Reddit isn’t the anger over one broken feature. It’s the deeper frustration about digital ownership. You spend $40,000 on a vehicle, and your right to check its battery level is contingent on VW’s app continuing to work, on VW’s servers staying online, and on VW not deciding tomorrow that this feature is now part of a connected-services tier.

This isn’t just a car problem. John Deere and the right-to-repair fight. Apple’s sideloading restrictions. Smart appliances that brick when the manufacturer’s cloud shuts down. They all grow from the same root: the gap between owning a thing and controlling it keeps getting wider.

Can the EU Data Act actually fix this?

There’s one genuinely hopeful signal. The EU Data Act, which began phased enforcement in 2025, includes a provision granting users the right to access data generated by their IoT devices and share it with third parties of their choosing. Cars are explicitly in scope.

If the law works as intended, VW would have to provide vehicle data on request in a standardized, usable form. The catch is what “usable” means in practice. A monthly CSV download buried in the official app technically complies. A real-time API that Home Assistant could plug into is a different beast. The Home Assistant incident may end up being the test case that defines how strictly regulators interpret that gap.

The takeaway

Buying a car is quietly becoming a bundled purchase: physical hardware plus a license to use the software that makes it work. The VW lockout isn’t a one-off — it’s a preview of how every connected device will eventually behave.

Next time you shop for a car, the spec sheet you actually need might not be horsepower and range. It might be: what rights do I have to the data this thing generates? The question of whose car it really is gets harder to answer every year.