This is one of those areas where people tend to use the phrase "It's against the law" when such a statement isn't universally true.
Analogies are
(i) "It's against the law to allow dogs in restaurants" ; and
(ii) "It's against the law to drive down the right-hand-side of the road in a two-way street"
Both of those statements are incorrect. (It's only against the law for restaurant owners to put their customer's health at risk, which doesn't automatically happen if they allow dogs in, and the milkman who drives down the 'wrong' side of an otherwise deserted road at 5am, while making his deliveries, isn't breaking the law because his driving is neither 'careless' not 'dangerous'). However they both illustrate situations where a breach of the law might occur under certain circumstances.
So, in itself, requesting a photograph with a c.v. is NOT illegal. It only becomes so if the reason for that request is to enable discrimination on one or more of the specific grounds which are covered by legislation. (e.g. while it's illegal to discriminate on the grounds of race, it's perfectly legal to discriminate against people with red hair unless it can be shown that, by doing so, an employer would, perhaps, be discriminating against Scottish and Irish people).
While I'd prefer not to see employers asking for photographs with c.v's (other than in a situation where it might genuinely be relevant, such as in some acting roles), I accept that in many countries it's the norm to enclose a photograph with a c.v.. (You'd probably reduce your chances of getting a job in France or Germany, for example, if you omitted to enclose a photograph. It also seems to be coming more common in the USA for people to include a photograph within the c.v. itself).