Cloaking is a black-hat tactic that serves search engine crawlers one version of a page while showing human visitors another. Because it deliberately deceives the ranking system about what a page contains, Google treats cloaking as a direct spam-policy violation that can get a site demoted or removed entirely.
A cloaked page detects who is requesting it — usually by user agent or IP address — and branches the response. The crawler receives keyword-rich, tightly optimised text; the visitor gets something completely different, whether an image-heavy landing page, an unrelated offer, or in malicious cases malware. Variants include serving text to bots but Flash or images to users, and swapping content based on the referring source.
The best-known example is real: in 2006 Google removed BMW's German site, bmw.de, from its index after discovering doorway pages built to feed crawlers keyword-stuffed content that users never saw. A brand of that size vanished from results until the pages were removed and the site was reconsidered. If Google will delist a Fortune 500 company, a smaller site attempting the same trick has far less cushion.
The line between cloaking and legitimate personalisation is intent: dynamically serving mobile users a lighter layout is fine because the crawler sees the same substance. Deceiving the crawler is what crosses into policy violation. Sites recovering from this usually need formal penalty removal, and it's worth understanding the wider family of search engine spam techniques that invite the same outcome.