GEKO Authorization Service for VAG Component Protection

You fitted a used MMI unit, instrument cluster or engine ECU to your Audi or Volkswagen, switched the ignition on, and the screen told you component protection is active. The part is not broken. It is locked to the car it came from, and it stays locked until VW Group’s own servers release it. That release is what a GEKO authorization service VAG dealers and a small number of independent specialists provide through ODIS online. No scanner or coding app on the market can do it offline. The good news is that the job is routine for anyone with the right access, usually takes under an hour, and in most cases happens remotely while the car sits in your driveway or workshop bay.

What Component Protection Is and Why It Locked Your Used Part

Component protection, or Komponentenschutz in VW’s own documentation, is an anti-theft measure that pairs selected control modules to the chassis number of the car they were first installed in. Audi introduced it around 2005 with the MMI 2G generation on the A6 and Q7, and the group extended it to Volkswagen, Skoda, SEAT, Porsche, Bentley and Lamborghini platforms over the following years. The logic is simple. If a stolen infotainment unit or cluster is worthless in any other car, there is less reason to steal it.

Every protected module stores a VIN reference and a status flag. On start-up it compares that stored data with what the gateway reports for the car it is sitting in. If the two do not match, the module drops into a restricted mode. A head unit will typically boot, show the component protection message and then refuse audio, navigation and phone functions. An instrument cluster may light every warning lamp and blank the mileage. An engine control unit may refuse to start or run with reduced function.

Four situations trigger it in practice:

• A used module from another car. This is the classic case. The part is fine. The VIN inside it is simply not yours.
• A new module fitted without an online release. Brand new parts ship in a protected state too. A workshop that fits one without completing the online adaptation leaves the car with the same error.
• A ‘patched’ module whose protection came back. Some sellers flash modified firmware that hides the protection flag. A later dealer software update or a battery event often restores the original state, and the lock returns.
• A module that lost its pairing after a fault. Rare, but we see clusters and gateways drop their pairing after a deep discharge or a jump start done with the ignition on.

Why Standard OBD Tools Cannot Remove Component Protection

This is the part that frustrates owners most. VCDS, OBDeleven, VCP and every generic scanner can read the fault and tell you the module is protected. None of them can clear it. Ross-Tech, the company behind VCDS, says in its own documentation at ross-tech.com that VCDS cannot remove component protection, and that is not a limitation they chose to add. The release is not stored anywhere in the car. It is calculated on VW Group’s backend from the module serial number, your VIN and the donor VIN, then pushed to the module through an authenticated online session.

Even a full copy of ODIS, the Offboard Diagnostic Information System the dealer network uses, does nothing here when it runs offline. ODIS has to be connected to the manufacturer’s servers, and the technician has to be logged in with a personal GEKO account. That login is what the trade means by a GEKO authorization service VAG customers keep asking about. Without it, the car stays locked no matter how good the tool on the bench is.

What a GEKO Authorization Service VAG Owners Can Book Actually Does

GEKO is short for Geheimnis und Komponentenschutz, which translates as ‘secrets and component protection’. It is the access level inside VW Group’s online diagnostic system that covers security-related functions: immobilizer data, key adaptation, component protection and certain protected coding. Each GEKO login belongs to a named, vetted technician, uses two-factor authentication, and every action is logged on the manufacturer’s servers against the vehicle’s VIN.

When you book a GEKO authorization service VAG specialists perform the following on the backend:

• Verify your VIN and the donor VIN, where one is available, against the theft register. A module from a vehicle reported stolen will not be released, full stop.
• Confirm the module’s part number and software version are approved for your chassis and model year.
• Issue the release that clears the protected state inside the module.
• Adapt the module to your VIN so it boots clean on the next ignition cycle.
• Where the module needs it, run the SVM online code or feature activation that configures it for your car’s equipment list.

Our component protection removal service covers that whole chain, from the first compatibility check to the final fault memory clear. It sits alongside our wider ECU programming and coding services for cases where the module also needs flashing or a full parameter set before it will talk to the rest of the car.

GEKO Authorization Service VAG Dealers Offer vs Independent Specialists

Every franchised dealer has GEKO access. The problem is policy, not capability. Many dealers will not release a used part at all, and those that do often insist on a diagnostic hour first and will not quote until the car is in the bay. Buying new is the easy sell, and a current MIB3 head unit or a virtual cockpit cluster from the parts counter costs more than many owners budgeted for the whole repair. The GEKO authorization service VAG dealers run and the one we run use the same backend. The difference is who is willing to release a used part, and how far they will go to make it fit.

The Component Protection Removal Process Step by Step

Here is what a real session looks like, whether it happens on our bench or remotely at yours.

• Compatibility check. Send us the VIN, the part number on the used module’s label, and a photo of the error screen. We confirm the module fits your platform and software index before anyone touches the car. This step prevents most failed jobs.
• Physical installation. Fit the module, reconnect every plug, and keep the ignition off until the last connector is home.
• Power and connection. A battery maintainer holding 13.0 V or better, a stable internet connection, and a proper diagnostic interface on the 16-pin OBD port. Pins 6 and 14 carry the CAN bus the session runs over.
• Online session. The technician opens ODIS online, logs in with GEKO credentials, selects the protected module and submits the release request.
• Adaptation and coding. The module is married to your VIN, coded for your equipment, and any required SVM code is run so the gateway accepts the new configuration.
• Verification. Fault memory is cleared, the ignition is cycled, and the module is checked for full function: audio, navigation, phone, mileage display or engine start, depending on what was fitted.

With a clean donor and the right part number, the online part takes 20 to 40 minutes. Add another 20 if the module arrives on an older software level and needs an update before the backend will accept it.

Remote GEKO Authorization Service for VAG Cars

A GEKO authorization service VAG owners book remotely works because the release happens between the manufacturer’s server and the module, not inside a laptop. You plug a compatible interface into the OBD port, and our technician drives the session over a secure connection. You need three things on your side: a battery maintainer, reliable internet at the car, and someone to turn the ignition on and off when asked. What cannot be done remotely is the physical work. If the used module needs a connector repaired, a bench flash before installation, or a cluster needs bench work before it will communicate, that part happens on a workbench, ours or a local workshop’s.

Which Parts Trigger Component Protection on MQB, MLB and MSB

The list has grown with every platform generation. On early cars it was mostly the infotainment stack. On current platforms it covers a large share of the module map.

• MQB (Golf 7 and 8, A3 8V and 8Y, Tiguan, Octavia, Leon): infotainment main unit, instrument cluster, engine control unit, gateway, amplifier, telephone module and the climate panel on some variants.
• MLB and MLB evo (A4 B8 and B9, A5, A6 C7 and C8, Q5, Q7 4M, Touareg CR, Cayenne 9Y, Bentayga, Urus): all of the above plus the MMI display, head-up display, rear-seat entertainment, driver assistance controllers and, on some MLB evo cars, the LED headlight power modules.
• MSB (Panamera 971, Continental GT and Flying Spur third generation): infotainment, cluster, gateway, amplifier and several body controllers.

Porsche applies the lock through its own PIWIS system and online access, while Bentley and Lamborghini go through the ODIS and GEKO route like Audi and Volkswagen. Because those two brands share VW Group electronics, the same lock sits on a Bentayga’s rear entertainment controller or a Urus cluster. There are very few independents worldwide with the access to release them, and we handle them regularly. For the official background on the platforms themselves, Audi’s own site is a reasonable starting point.

Component Protection vs the Immobilizer

Owners often mix these two up, and it costs them money. The immobilizer decides whether the engine is allowed to start. It links the key, the cluster, the engine ECU and, on later cars, the gateway through shared secret data. Component protection decides whether a module is allowed to work in this car at all. A used engine ECU on an MQB car needs both: component protection removed and the immobilizer adapted. A used head unit needs only component protection removed. Both can be handled in the same online session during a GEKO authorization service VAG workshops send to us, but they are separate procedures with separate checks. If a shop clears one and not the other, you get a car that still does not start, and a second invoice. Ask up front which steps are included.

Mistakes That Make a Used Part Unrecoverable

• Buying from a vehicle with a theft record. The backend checks. The module will never be released, and the seller is unlikely to refund you.
• Buying a unit built for a different sales region. It may release and still fail on radio bands, map data and language sets.
• Paying for ‘CP-free’ patched firmware. It works until the next dealer update or a deep battery discharge, then you are back where you started with a module the backend now sees as tampered.
• Ignoring the software index. Same part number, older software, different behavior. We check this before the session so the backend does not reject the module half way through.
• Running the session on a weak battery. A voltage dip during adaptation can leave the module in a half-written state that is far harder to recover than the original lock.

How to Book a GEKO Authorization Service VAG Owners and Workshops Trust

Your used part is not dead. It is waiting for one authenticated handshake with the manufacturer’s servers, and a GEKO authorization service VAG specialists like us provide is the only clean route to that handshake. Whether you are a private owner with one car or a workshop that fits used modules every week, the process is the same. Send the VIN, the module part number and a photo of the error. We confirm fit, then release and adapt the part either on our bench or through our remote VAG programming service at your location. Most jobs are finished the same day. The result is a module that behaves exactly as a dealer-fitted new one would, at a fraction of the cost, with every step logged against your VIN.