The Cloaking device detects through the IP address if a user is a regular person or a search engine spider. When the user is detected as such, a server-side script displays a different version of the website than the one presented to the normal users. This version contains information/content that is not displayed in the visible site, the trying-to-hide information could be from just non-mediatic content that would not perform as good, to ads and inappropriate content.
The goal a black-hat wants to achieve when using this practice is to search engines to give the website a higher ranking in the search results, or so the page gets to show when otherwise would not.
Cloaking was also used as a functional tool by content creators to show content like graphic and multimedia elements that could not be shown otherwise, such as videos or Adobe Flash components. Still, nowadays, this practice is not necessary in most cases because search engines have been actualized for it.
Cloaking is not prohibited in legal terms; the law does not punish it, but if a website is detected, Cloaking by a search engine will most likely be penalized and removed from the search engine index. This means the page will no longer appear in the search results, even though it will still be possible to access it from a direct link. An example of this is that a site using Cloaking will be acknowledged as a breach of Google’s Webmaster’s norms.