Why is it not illegal to use Polyjuice Potion? It is the magical equivalent of identity theft.
Who says is isn't illegal? It was found by Hermione only in Most Potente Potions, a very old book in Hogwarts' Restricted section. If it is now illegal, it probably was not, like the Unforgivable Curses, at the time the book was written. And when it was made illegal, the Hogwarts administration probably had forgotten they had the book, or just didn't care. The fact that it was put in the Restricted section and that it wasn't, as far as I can remember, taught (except to a group of select students in the NEWT classes) probably means that many adult wizards had never even heard of it, let alone have the skill and resources required to make it.
Also, it can't be used as identity theft is today because you need something like a hair from the identity-theftee before you can become an identity-thefter. You also need a bunch of rare ingredients and a month, I believe, to make it.