I'm using cookies to determine whether or not I should show certain content to a user. But since googlebot doesn't (I presume) accept cookies, it won't ever see this content. But will see other content that users only see on their first visit. It's not my whole page, it's just an image that I only want first-time visitors to see. I then set a cookie so they don't see it again. But is this alright since I'm showing different content to googlebot and users?
Indeed its not cloaking.Cloaking means ,serving different content to S.E and visitors.Since you are serving same content to first time visitors and S.E , its not cloaking.
I agree it's not cloaking. Actually, cloaking is not necessarily something forbidden. I use a user agent detection that identifies the Googlebot and removes the partner references from the URLs of my site just for the Bot but not for ther users, and that's ethical cloaking since it's done to avoid duplicate content (different URLs with the same content). I've been using it for over a year and my positions have improved as I got rid of a serious duplicate content issue.
It's basically the logical way to avoid this kind of duplicate content, as each URL is considered a different webpage, and we had hundreds of different partner references, so we were suffering a serious problem of duplicate content. I've heard of other companies that make a 301 redirect for google in their cobrands and it works good for them as well.