When I originally bought my car last year, and was under the full court press by VW to have me sign-up for the free CarNet trial I reviewed the capabilities and at the time you could unlock your car but you could not lock it. So for instance if I had parked my car and walked a couple of blocks away and realized that I might not have locked my car, I could verify if it was or was not locked via my smart phone, but if it wasn't I could not lock it remotely and would have to walk all the way back to my car to lock it. No doubt in my mind that the functional capability to perform that remote locking task is present, but was just a feature that they were not offering at the time. Has that changed? The Car-Net website still shows the remote key FOB with just the "unlock" symbol.
To the OP's original comments about being paranoid that VW would be able to track you constantly, in the end I never enabled mine as the engine diagnostics capabilities made me concerned that "big brother" VW would be monitoring all kinds of driving and engine performance data and could potentially allow them to see how you drive the car and possibly see if you had your ECU flashed, etc. In the back of my mind I figure that as long as the CarNet module is enabled they probably have access to your cars data whether you have agreed to take their service or not. I would personally like to fully disable the feature if possible, but based on a few other threads its not going to be an easy process.
