The device state indicates how freely software can be flashed to a device and whether verification is enforced. Device states are LOCKED and UNLOCKED. LOCKED devices prevent you from flashing new software to the device, whereas UNLOCKED devices allow modification.
When a device powers on, the bootloader first checks if a device is LOCKED or UNLOCKED. If a device is UNLOCKED, the bootloader shows the user a warning and then proceeds to boot even if the loaded OS isn't signed by the root of trust.
If the device is LOCKED, the bootloader goes through the steps in Verifying Boot to verify the device's software. LOCKED devices boot only if the loaded OS is properly signed by the root of trust. For more details, see The boot flow.
Changing device state
To change a device's state, use the fastboot flashing [unlock | lock] command. To protect user data, all state transitions wipe the data partitions and ask for user confirmation before data is deleted.
The UNLOCKED to LOCKED transition is anticipated when a user buys a used development device. As a result of locking the device, the user should have confidence that it is in a state produced by the device manufacturer, as long as there is no warning. The LOCKED to UNLOCKED transition is expected when a developer wishes to disable verification on the device for development purposes.