Google’s John Mueller said in a Reddit thread that if you end up showing your hreflang markup just to search engine crawlers and not humans, i.e. cloaking, that it would still be considered cloaking but you probably won’t be penalized for doing so. He still highly discourages you taking this approach.
John was asked “My client is only serving hreflang mark-up to search engine user agents, not human visitors. Would this be considered cloaking?”
John answered “Sure, it’s cloaking.” “I think what you’re asking is more like “will I get a webspam penalty if I do this?” to which the answer is no,” he added.
John then said he would avoid doing this because it can be confusing down the road. He wrote:
Generally speaking, I’d still discourage from doing it since you’re making it significantly harder to test & monitor your site. One of the most common reasons why the indexing team asks folks at Google to contact sites is because they try to be fancy and do this kind of cloaking, and that “fanciness” breaking without them noticing. Often this is done by smart & technically savvy folks, who work on great sites. It’s possible that you’ll be able to do it better than them, and that things won’t break once you split your site into versions for search engines & users (and perhaps, different kinds of users & search engines too, like desktop & mobile). The risk in this particular case is much more in terms of your site causing itself technical problems (now & years down the road, when you’re perhaps no longer directly involved), rather than the webspam team feeling the need to apply a manual action.
I am not sure how many of you who implement hreflang actually cloak it. I mean, why would you? It is just markup anyway and humans aren’t looking at your markup.
Forum discussion at Reddit.