Is it illegal for airlines & booking providers to charge a cancellation fee on bookings?

According to the CFR:

14 CFR 259.5

(a) Adoption of Plan. Each covered carrier shall adopt a Customer Service Plan applicable to its scheduled flights and shall adhere to this plan's terms.
(b) Contents of Plan. Each Customer Service Plan shall, at a minimum, address the following subjects:
...
(1) Offering the (4) Allowing reservations to be held without payment or cancelled without penalty for a defined amount of time;

Where covered carrier is defined in 14 CFR 244.1:

Covered carrier means a certificated carrier, a commuter carrier, or a foreign air carrier operating to, from, or within the United States, conducting scheduled passenger service or public charter service with at least one aircraft having a designed passenger seating capacity of 30 or more seats.

Hence travel agents are not currently covered under these regulations. You can read about this on threads such as this one on flytalk

Then I complained to the US DOT and to my surprise got the following response:

"This responds to your communication regarding Lan Airlines and Priceline. Based on the information you have provided, your complaint appears not to fall under the Department's rules as the 24 hour cancellation policy doesn't currently apply to Online Travel Agencies (OTAs)."

There is an effort to expand this to large travel agents:

The rules, if adopted, would also broaden the definition of the term “ticket agent” to include “entities operating websites that provide flight search tools that manipulate, manage and display fare, schedule and availability information.” The DOT specifically stated that Google and Kayak would be covered.

Require large ticket agents (with annual revenue of $100 million or more) to adopt “customer service commitments,” such as providing prompt refunds and timely notice of itinerary changes, plus the option to hold a reservation for 24 hours without penalty.

This article discusses some of the issues and this one gives more detail.

Here's a short extract from the latter:

If you are booking an airfare in the United States, U.S. Department of Transportation regulations require that, as long as you've booked a non-refundable ticket 7 days ahead of your flight, you're entitled to change or cancel your reservation within 24 hours of booking, without paying a cancellation fee.

You can either cancel the reservation entirely, or change it, within the 24-hour window. If you change it however, a fare difference may apply, but there is no change penalty. This applies not just to U.S.-based airlines, but any airline selling airfares in the U.S.

You still have to pay for the airfare, and then get a refund without penalty.

American Airlines is a bit different in that it allows you to hold your seat and the fare for 24 hours without paying for it. On American, you should NOT pay for the fare, but merely choose the 24-hour hold option without payment. If you pay for the fare rather than holding it, you will be hit with a change/cancel fee on American!

From what I read your summary of the law (or rather DOT regulations) is not quite complete and my guess is that airlines are very clever at following the letter of the regulations.