There is nothing like the joy on a child’s face when they open the perfect gift. But consumer advocates are raising concerns that some of this year’s bestsellers may not be safe.

Just as household items like doorbells and cameras are going high-tech, so are toys. One example, is My Friend Cayla, a “smart” doll which asks children questions, and records their answers.

But The Public Interest Group (U.S. PIRG) is concerned Cayla may be used as a digital spy. At a recent press conference, PIRG demonstrated how Cayla’s speaker can be used to listen in and talk to a child by hackers.

“The risk that a doll like My Friend Cayla poses is that she can be accessed with a Bluetooth connection without a password,” said Mike Litt, a consumer campaign director for PIRG.

“So if a stranger is within distance of the Bluetooth connection than they can actually listen in on your child. They can talk to your child,” he added.

The interactive doll isn’t alone. Which?, a U.K. consumer advocacy organization, found security or privacy concerns with 5 additional connected toys.

“We’re already seeing that more of these Internet of Things toys are coming onto the market,” Litt said.

German regulators have actually banned My Friend Cayla, and at least one consumer group has filed a complaint with the Federal Trade Commission (FTC), which regulates children’s online safety. Additionally, the Consumer Product Safety Commission (CPSC) is looking into Internet connected toys.

“We are just beginning to look into this and we’re working with our sister agencies to see who should have which responsibility and who has the expertise to delve into that,” said Joe Martyak, CPSC’s director of communications.

Genesis Toys, which makes My Friend Cayla, did not respond to CNBC’s request for comment. Still, there have been no incidents related to Cayla, according to The Toy Association, an industry trade group.

“Toy safety is the toy industry’s number one priority and that’s not just the physical safety of the toy, but the online safety of the child playing with the toy,” said Rebecca Mond, the Toy Association’s senior director for federal government affairs.

Another hot toy on PIRG’s radar is fidget spinners. The consumer advocacy group tested the popular toy, sold in a variety of stores, and found two at retail giant Target that were laden with lead. A CPSC accredited lab was used for the testing.

“One of them is the Wild Fidget Premium Spinner Brass which had a whopping 33,000 parts per million of lead, which is 330 times the legal limit for lead allowed for a children’s product,” Litt said.

Perhaps more shocking: That fidget spinner is perfectly legal because the label says ages 14 and over, which means CPSC toy regulations do not apply.

“If fidget spinners are marketed 12 year olds and younger than they do have to meet our lead standards that are very stringent for children’s toys,” CPSC’s Martyak said.

Despite a decline in lead in children’s products, the metal is still a concern, according to Dr. Lenore Jarvis of the American Academy of pediatricians.

“The concern, particularly with younger children is often toys are handled and then their hands either go in their mouth or the toy goes in the mouth,” Jarvis said.

The silver lining is that in 2017, there were no recalls for lead in toys for children under 12, down from 19 in 2008.

Still consumer advocates feel more needs to be done. “There is no reason why these fidget spinners shouldn’t actually adhere to the limits that do exist for similar types of products,” said Litt.

“Safety is one of our top priorities. All of our product are tested and comply with CPSC safety standards,” said Harold Chizick, a spokesman for Bulls-i-Toy, which makes the fidget spinners, in a statement sent to CNBC by email.

“While these two products comply with all CPSC guidelines for fidget spinners, based on the concerns raised, we’re removing them from our assortment. Additionally, we’re working closely with our vendors to ensure all of the fidget spinners carried at Target meet the CPSC’s guidelines for children’s products,” said Jenna Reck, a spokeswoman for Target, in a statement sent by email.

To protect kids from lead, consumers should make sure to read age labels. Anything for children age 12 and under must meet the CPSC’s lead regulations.

When it comes to connected toys, the best advice is to change default passwords, although some, like My Friend Cayla do not have a password. You should also not leave children unattended when playing with connected toys, and turn them off when not in use.

On the Money airs on CNBC Saturday at 5:30 am ET, or check listings for air times in local markets.