If an input bytestring starts with a BOM, aeson will fail to parse it as JSON with the error message "Error in $: Failed reading: not a valid json value". Rejecting the input is correct per the spec, and as discussed in #389 it is better for the application to remove the BOM before parsing if needed, rather than having aeson do it automatically.
However, it would be nice if the error message was more explicit about the cause of the problem. At least that would have saved me a bit of confusion when I couldn't get aeson to parse a JSON file that looked perfectly fine in my editor. :-)