An aerosol-generating system, comprising: an aerosol-generating device configured to generate aerosol, the aerosol-generating device having a locked state in which the aerosol-generating device is prohibited from generating aerosol and an unlocked state in which the aerosol-generating device is permitted to generate aerosol; and a receiving device configured to at least partially receive the aerosol-generating device wherein each of the aerosol-generating device and the receiving device includes a communication interface (108, 310) for communicatively coupling the aerosol-generating device with the receiving device; wherein the receiving device includes a control arrangement with at least one biometric sensor configured to authenticate a user of the aerosol-generating system based on sensing at least one biometric feature of the user; wherein the control arrangement is configured to transmit an authentication signal to the aerosol-generating device to configure the aerosol-generating device into the locked state or the unlocked state, the authentication signal being indicative of a successful or an unsuccessful authentication of the user at the receiving device; wherein the aerosol-generating system is configured to enter the aerosol-generating device into the locked state based on one or more locking conditions, which includes determining at least one of: a maximum number of usage sessions of the aerosol-generating device by the user since the last successful authorization of the user at the receiving device, a maximum number of charge cycles performed since the last successful authorization of the user at the receiving device, and a maximum period of time expired since the last successful authorization of the user at the receiving device. an aerosol-generating device configured to generate aerosol, the aerosol-generating device having a locked state in which the aerosol-generating device is prohibited from generating aerosol and an unlocked state in which the aerosol-generating device is permitted to generate aerosol; and a receiving device configured to at least partially receive the aerosol-generating device wherein each of the aerosol-generating device and the receiving device includes a communication interface (108, 310) for communicatively coupling the aerosol-generating device with the receiving device; wherein the receiving device includes a control arrangement with at least one biometric sensor configured to authenticate a user of the aerosol-generating system based on sensing at least one biometric feature of the user; wherein the control arrangement is configured to transmit an authentication signal to the aerosol-generating device to configure the aerosol-generating device into the locked state or the unlocked state, the authentication signal being indicative of a successful or an unsuccessful authentication of the user at the receiving device; wherein the aerosol-generating system is configured to enter the aerosol-generating device into the locked state based on one or more locking conditions, which includes determining at least one of: a maximum number of usage sessions of the aerosol-generating device by the user since the last successful authorization of the user at the receiving device, a maximum number of charge cycles performed since the last successful authorization of the user at the receiving device, and a maximum period of time expired since the last successful authorization of the user at the receiving device. a maximum number of usage sessions of the aerosol-generating device by the user since the last successful authorization of the user at the receiving device, a maximum number of charge cycles performed since the last successful authorization of the user at the receiving device, and a maximum period of time expired since the last successful authorization of the user at the receiving device.